Storing the SSH public key #472

Open
annevk opened this Issue Jan 14, 2017 · 2 comments

Projects

None yet

2 participants

@annevk
annevk commented Jan 14, 2017

Rather than setting StrictHostKeyChecking to no or using ssh_known_hosts in addons, I would prefer explicitly specifying the fingerprint. It seems that otherwise my deployment would be susceptible to man-in-the-middle attacks.

All the searches I did came up with folks recommending disabling security, which seems rather strange.

@annevk
annevk commented Jan 14, 2017

It turns out this is possible at least through creating a local known_hosts resource and using -o UserKnownHostsFile=known_hosts whenever using ssh or scp.

It would be good if https://docs.travis-ci.com/user/ssh-known-hosts/ pointed that out. Or provided syntax for including the public key.

@annevk annevk changed the title from Storing RSA key fingerprints to Storing the SSH public key Jan 14, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment